Open Database Leaked 179GB In Customer, US Government, and Military Records (zdnet.com) 15
An open database exposing records containing the sensitive data of hotel customers as well as US military personnel and officials has been disclosed by researchers. ZDNet reports: On Monday, vpnMentor's cybersecurity team, led by Noam Rotem and Ran Locar, said the database belonged to Autoclerk, a service owned by Best Western Hotels and Resorts group. Autoclerk is a reservations management system used by resorts to manage web bookings, revenue, loyalty programs, guest profiles, and payment processing.
In a report shared with ZDNet, the researchers said the open Elasticsearch database was discovered through vpnMentor's web mapping project. It was possible to access the database, given it had no encryption or security barriers whatsoever, and perform searches to examine the records contained within. The team says that "thousands" of individuals were impacted, although due to ethical reasons it was not possible to examine every record in the leaking database to come up with a specific number. Hundreds of thousands of booking reservations for guests were available to view and data including full names, dates of birth, home addresses, phone numbers, dates and travel costs, some check-in times and room numbers, and masked credit card details were also exposed. Some of the records were logs for U.S. Army generals visiting Russia and Israel, the report says. In total, the AWS-hosted database contained over 179GB of data.
In a report shared with ZDNet, the researchers said the open Elasticsearch database was discovered through vpnMentor's web mapping project. It was possible to access the database, given it had no encryption or security barriers whatsoever, and perform searches to examine the records contained within. The team says that "thousands" of individuals were impacted, although due to ethical reasons it was not possible to examine every record in the leaking database to come up with a specific number. Hundreds of thousands of booking reservations for guests were available to view and data including full names, dates of birth, home addresses, phone numbers, dates and travel costs, some check-in times and room numbers, and masked credit card details were also exposed. Some of the records were logs for U.S. Army generals visiting Russia and Israel, the report says. In total, the AWS-hosted database contained over 179GB of data.
Re: (Score:1)
Why can't they just count the records? (Score:3, Insightful)
Re:Why can't they just count the records? (Score:4, Insightful)
Ahh padawan I see you do not understand, here is the lesson lowest tender vs safety and security. When you do it as cheap as you can do not expect good outcomes they will not happen, they failed because profit was the primary focus and costs are the enemy of profit, the blood enemy, the enemy to be ruthlessly relentless attacked and of course, the fuck up, turned into someone else's problem after you have wandered off with the profits and bonuses. Accept zero change until the persons responsible for those actions and decisions face custodial sentences. Expect pretty rapid range after a CEO, board members and tech staff, receive years long custodial sentences, bloody overnight change, they start spending ten times as much on lobbyists getting laws changed. You don't thing they would eve give a fuck about actually security do you, only if there is a profit in it. Face the profit in security is breaking it and not making it, all the profits from security relate to hacking it and accessing the data, from corporate financial data for insider trading, to extortion material to stealing patentable ideas (corporations and even corrupt governments all play, steal ideas and claim them through illegal surveillance, pathetic liars, cheats and thieves being who they are, taking pride in being liars cheats and thieves.)
The system has been fucked by psychopaths and will routinely fail.
Re: (Score:3, Insightful)
Re:Why can't they just count the records? (Score:4, Insightful)
Why even care anymore? (Score:5, Insightful)
Count the movements of (Score:4, Insightful)
In town for police work...
Someone is watching the US mil/CIA/FBI the same way the UK counted German troop trains in WW1.
AWS ... (Score:3)
Access Welcome Security.
The customers who buy a bucket don't bother to lock the doors. That's on the customers.
Why Even Bother Reporting Breaches (Score:3)
Password taped to desk? (Score:5, Interesting)
I stayed at a Best Western in Georgia (US) once and they had the username and password for their reservation system written on a note taped next to the computer. I told them about it and the answer was "Well, even if someone took that they could only get into our local system; they wouldn't be able to do anything besides messing with our reservations." My suggestion that they at least move the password to a place where customers couldn't see it was met with a bored stare.
They don't know how many? (Score:3)
Hmm. Not number of records this time. (Score:1)
Lets assume this is all base 2 and not base 10. (Base 10 can be called ib)
Lats say $2500 for every MB lost. Thats 22912MB. That works out to be $57,280,000